Salesforce Graph Engine Rules (Retired)
Salesforce Graph Engine includes path-based and data-flow analysis rules.
| Rule | Type | Category | Status | Description |
|---|
| ApexFlsViolationRule | Path-based analysis | Security | Generally Available (GA) | Detects Create, Read, Update, and Delete (CRUD) and Field-Level Security violations. |
| ApexNullPointerExceptionRule | Path-based analysis | Error-Prone | GA | Identifies Apex operations that dereference null objects and throw NullPointerExceptions. |
| AvoidDatabaseOperationInLoop | Path-based analysis | Performance | GA | Detects database operations in loops that degrade performance. |
| AvoidMultipleMassSchemaLookups | Path-based analysis | Performance | GA | Detects scenarios where expensive schema lookups are made more than one time in a path. |
| PerformNullCheckOnSoqlVariables | Path-based analysis | Performance | GA | Identifies SOQL queries with variables in WHERE clauses that lack null checks. |
| RemoveUnusedMethod | Path-based analysis | Performance | Pilot | Detects methods contained in your code that aren’t invoked from any entry points that Graph Engine recognizes. |
| UnimplementedTypeRule | Graph-based analysis | Performance | GA | Detects abstract classes and interfaces that are non-global and missing implementations or extensions. |
| UseWithSharingOnDatabaseOperation | Path-based analysis | Security | GA | Detects database operations outside with-sharing-annotated classes. |
Running Graph Engine GA Rules
Run all Graph Engine rules against your code, or run a subset of rules by type or by category.
To run the path-based rules, run scanner run dfa --projectdir MyDirectory. For example:
sf scanner run dfa --projectdir /project/dir --target /project/dir/target1
To run graph-based analysis rules, run scanner run --engine sfge --projectdir MyDirectory. For example:
sf scanner run --engine sfge --projectdir /project/dir --target /project/dir/target1
To run a specific category of rules, include the category. For example:
sf scanner run dfa --category Security --projectdir /project/dir --target /project/dir/target
Running Graph Engine Pilot Rules
To run each Graph Engine pilot rule, include the --with-pilot flag in your request.
To run all Graph Engine rules and all pilot rules, run: sf scanner run dfa --with-pilot --engine sfge --projectdir MyDirectory. For example:
sf scanner run dfa --with-pilot --engine sfge --projectdir /project/dir --target /project/dir/target1
To run a specific category of rules including the pilot rules in that category, include the category and the --with-pilot flag. For example:
sf scanner run dfa --category Performance --with-pilot --engine sfge --projectdir /project/dir --target /project/dir/target1
Roadmap
We’re working on adding more rules. In the meantime, give us your feedback.
As of August 2025, Salesforce Code Analyzer v4 is retired and no longer supported. Use Code Analyzer v5 instead.
j